Monday, March 20, 2023
  • Advertise With Us
  • Write For Us
  • Contact Us
  • About Us
  • Editorial Calendar
Download Latest Issue - Free!
The Cyber Express
Ransomware Report
  • MagazineDownload
  • Firewall Daily
    • All
    • Dark Web News
    • Data Breach News
    • Hacking News
    • Ransomware News
    • Vulnerabilities
    Microsoft Outlook Vulnerability

    Microsoft Outlook Zero Day Vulnerability Actively Exploited

    GISEC Global 2023

    GISEC Global 2023: H.E. Dr Mohamed Hamad Al-Kuwaiti Recognized for Outstanding Contributions in Advancing Global Cybersecurity

    Gamekaking Data Breach

    Gamekaking Data Breach? Leakbase Claims to Upload 19 Million Rows of Stolen Information

    Medusa Ransomware Group

    Medusa Ransomware Group Targets National Institute of Ocean Technology

    BreachForums

    FBI Arrests BreachForums Operator ‘Pompompurin’, Slaps Cybercrime Charges

    Clop Ransomware Group Adds Hitachi Energy

    Hitachi Energy Confirms Security Incident After Clop Ransomware Adds it to Victim List

    Onex Data Exposed

    Onex Data Exposed, Linked to GoAnywhere MFT Security Incident

    Euler Finance Cyber Attack

    Euler Finance Cyber Attack Hackers Returns $165k to Victim

    Independent Living Systems Data Breach

    Independent Living Systems Data Breach Puts 4.2 Million Individuals at Risk

  • Essentials
    • All
    • Compliance
    • Governance
    • Policy Updates
    • Regulations
    BreachForums

    FBI Arrests BreachForums Operator ‘Pompompurin’, Slaps Cybercrime Charges

    Cybersecurity Excellence Awards

    Cybersecurity Excellence Awards: Cyble Rated Fastest Growing Cybersecurity Company

    Insider threat mitigation

    Behavioral Psychology, a Boon for Insider Risk Mitigation

    Safer Internet

    International Safer Internet Day: How Safe Are Our Teenagers Online?

    TRAI

    TRAI Asked to Involve MoD in Drafting Big Data Regulations & Policies

    cybersecurity

    Cybersecurity incidents may soon be ‘uninsurable’

    Australia

    Australia Ropes in Tech Veterans to Set Up Cyber Action Plan

    Active Directory

    Prevent Ransomware: Save the Active Directory

    Privacy Penalty Bill

    Privacy Penalty Bill: Australian Parliament Approves Heavy Fines

    • Regulations
    • Compliance
    • Governance
    • Policy Updates
  • Features
    • Cyber Warfare
    • Espionage
    • Workforce
      • Learning & Development
  • Business News
    • All
    • Appointments
    • Budgets
    • Mergers & Aquisitions
    • Partnerships
    • Press Release
    • Startups
    GISEC Global 2023

    GISEC Global 2023: H.E. Dr Mohamed Hamad Al-Kuwaiti Recognized for Outstanding Contributions in Advancing Global Cybersecurity

    GISEC Global 2023

    GISEC Global 2023: Knowledge Sharing, Collaboration Vital to Fend off Cyberattacks, say Experts

    Call & Contact Center Expo 2023 Las Vegas

    Call & Contact Center Expo 2023 Las Vegas

    Former BookMyShow CTO Mahesh Vandi Chalil

    Cyble Appoints Former BookMyShow CTO Mahesh Vandi Chalil as Chief Product and Technology Officer

    GISEC 2023

    GISEC 2023: Microsoft Highlights Zero Trust Approach and Mixed Reality Policing Tools

    GISEC Global 2023

    GISEC Global 2023: ‘Take the Fight to Cyber Attackers’ Urges UAE Cybersecurity Council Paper

    Cyble in Forbes List

    Cyble Recognized by Forbes as One of America’s Best Startup Employers 2023

    Cybersecurity Excellence Awards

    Cybersecurity Excellence Awards: Cyble Rated Fastest Growing Cybersecurity Company

    Cyble Among Top 50 Emerging Companies

    Cyble Among Top 50 Emerging Companies Across Governance Risk & Compliance Solutions Sector

    • Startups
    • Mergers & Aquisitions
    • Partnerships
    • Appointments
    • Budgets
    • Research
      • Whitepapers
      • Sponsored Content
      • Market Reports
    • Interviews
      • Podcast
  • EventsCyberCon
    •  Cyber Security Webinar
    • World CyberCon Middle East 2023
    • Endorsed Events
No Result
View All Result
The Cyber Express
  • MagazineDownload
  • Firewall Daily
    • All
    • Dark Web News
    • Data Breach News
    • Hacking News
    • Ransomware News
    • Vulnerabilities
    Microsoft Outlook Vulnerability

    Microsoft Outlook Zero Day Vulnerability Actively Exploited

    GISEC Global 2023

    GISEC Global 2023: H.E. Dr Mohamed Hamad Al-Kuwaiti Recognized for Outstanding Contributions in Advancing Global Cybersecurity

    Gamekaking Data Breach

    Gamekaking Data Breach? Leakbase Claims to Upload 19 Million Rows of Stolen Information

    Medusa Ransomware Group

    Medusa Ransomware Group Targets National Institute of Ocean Technology

    BreachForums

    FBI Arrests BreachForums Operator ‘Pompompurin’, Slaps Cybercrime Charges

    Clop Ransomware Group Adds Hitachi Energy

    Hitachi Energy Confirms Security Incident After Clop Ransomware Adds it to Victim List

    Onex Data Exposed

    Onex Data Exposed, Linked to GoAnywhere MFT Security Incident

    Euler Finance Cyber Attack

    Euler Finance Cyber Attack Hackers Returns $165k to Victim

    Independent Living Systems Data Breach

    Independent Living Systems Data Breach Puts 4.2 Million Individuals at Risk

  • Essentials
    • All
    • Compliance
    • Governance
    • Policy Updates
    • Regulations
    BreachForums

    FBI Arrests BreachForums Operator ‘Pompompurin’, Slaps Cybercrime Charges

    Cybersecurity Excellence Awards

    Cybersecurity Excellence Awards: Cyble Rated Fastest Growing Cybersecurity Company

    Insider threat mitigation

    Behavioral Psychology, a Boon for Insider Risk Mitigation

    Safer Internet

    International Safer Internet Day: How Safe Are Our Teenagers Online?

    TRAI

    TRAI Asked to Involve MoD in Drafting Big Data Regulations & Policies

    cybersecurity

    Cybersecurity incidents may soon be ‘uninsurable’

    Australia

    Australia Ropes in Tech Veterans to Set Up Cyber Action Plan

    Active Directory

    Prevent Ransomware: Save the Active Directory

    Privacy Penalty Bill

    Privacy Penalty Bill: Australian Parliament Approves Heavy Fines

    • Regulations
    • Compliance
    • Governance
    • Policy Updates
  • Features
    • Cyber Warfare
    • Espionage
    • Workforce
      • Learning & Development
  • Business News
    • All
    • Appointments
    • Budgets
    • Mergers & Aquisitions
    • Partnerships
    • Press Release
    • Startups
    GISEC Global 2023

    GISEC Global 2023: H.E. Dr Mohamed Hamad Al-Kuwaiti Recognized for Outstanding Contributions in Advancing Global Cybersecurity

    GISEC Global 2023

    GISEC Global 2023: Knowledge Sharing, Collaboration Vital to Fend off Cyberattacks, say Experts

    Call & Contact Center Expo 2023 Las Vegas

    Call & Contact Center Expo 2023 Las Vegas

    Former BookMyShow CTO Mahesh Vandi Chalil

    Cyble Appoints Former BookMyShow CTO Mahesh Vandi Chalil as Chief Product and Technology Officer

    GISEC 2023

    GISEC 2023: Microsoft Highlights Zero Trust Approach and Mixed Reality Policing Tools

    GISEC Global 2023

    GISEC Global 2023: ‘Take the Fight to Cyber Attackers’ Urges UAE Cybersecurity Council Paper

    Cyble in Forbes List

    Cyble Recognized by Forbes as One of America’s Best Startup Employers 2023

    Cybersecurity Excellence Awards

    Cybersecurity Excellence Awards: Cyble Rated Fastest Growing Cybersecurity Company

    Cyble Among Top 50 Emerging Companies

    Cyble Among Top 50 Emerging Companies Across Governance Risk & Compliance Solutions Sector

    • Startups
    • Mergers & Aquisitions
    • Partnerships
    • Appointments
    • Budgets
    • Research
      • Whitepapers
      • Sponsored Content
      • Market Reports
    • Interviews
      • Podcast
  • EventsCyberCon
    •  Cyber Security Webinar
    • World CyberCon Middle East 2023
    • Endorsed Events
No Result
View All Result
The Cyber Express
No Result
View All Result
Home DDoS Attacks News

Mirai to Medusa Botnet, Hackers Up Their Game to Launch Cyberattacks

While researchers found some incapabilities in the programming of the Medusa botnet, it still successfully launched DDoS attacks on certain levels of the network, including layers 3, 4, and 7.

Vishwa Pandagle by Vishwa Pandagle
February 7, 2023
in DDoS Attacks News, Firewall Daily, Vulnerabilities
0
Mirai to Medusa Botnet
653
SHARES
3.6k
VIEWS
Share on LinkedInShare on Twitter

A variation of the Mirai botnet was spotted downloading and spreading a new botnet. Dubbed “Medusa Botnet”, it connects to the command and control server once activated and obtains the “medusa_stealer.sh” file, which it then runs.
Mirai, the malware that targets smart devices powered by ARC processors and transforms them into a network of bots or “zombies” that can be remotely controlled. This network, referred to as a botnet, is frequently employed to carry out DDoS (Distributed Denial of Service) attacks.

Researchers at the Cyble Research and Intelligence Labs (CRIL), in collaboration with the Cyble Global Sensor Intelligence (CGSI), identified a new variant of the Mirai botnet.

You might also like

Microsoft Outlook Zero Day Vulnerability Actively Exploited

GISEC Global 2023: H.E. Dr Mohamed Hamad Al-Kuwaiti Recognized for Outstanding Contributions in Advancing Global Cybersecurity

Gamekaking Data Breach? Leakbase Claims to Upload 19 Million Rows of Stolen Information

Mirai, which thrives on vulnerabilities in systems running Linux, was found downloading the Medusa botnet. The botnets can launch several types of cyberattacks, including Distributed Denial of Service (DDoS) and ransomware attacks.

While researchers found some incapabilities in the programming of the Medusa botnet, it still successfully launched DDoS attacks on certain levels of the network, including layers 3, 4, and 7. The Medusa botnet and Mirai botnet launch brute force attacks that use several attempts to guess the password of the target, among other credentials.

Mirai to Medusa Botnet

Details found in the medusa_stealer.sh file (Photo: Cyble)

The Mirai botnet downloads the medusa_stealer.sh file when it connects to the command and control (C&C) server.

Researchers found the features of the Medusa botnet, written in the Python script, which is confirmed by seeing the source code of the botnet. The following are the four found parameters of the Medusa botnet:

  1. ‘Method’ for taking attack-related commands from the C&C server.
  2. ‘IP’ to access the IP address of the victim
  3. ‘Port’ to collect the port number
  4. ‘Timeout’ to stop the attack

The Medusa botnet attacked networks using either spoofed IP addresses or the IP address of the victims. This was done using the spoofer() function. It would keep creating new IP addresses to not be detected.

Mirai to Medusa Botnet

Spoofer() function of the Medusa botnet (Photo: Cyble)

Ransomware attacks launched by the Medusa botnet

Similarly, the Medusa botnet used the MedusaRansomware() function to launch a ransomware attack. It encrypts all the files mentioned in the ‘extensions’ list by adding the .medusastealer extension to the file names.

It encrypts files with a Python library using an AES 256-bit encryption key sparing only the system files and those that are already encrypted. It targets files with several extensions including:

  1. .js
  2. .rb
  3. .go
  4. .html
  5. .docm
  6. .dotm
  7. .xsl
  8. .svg
  9. .wsf
  10. .wsh

Mirai to Medusa Botnet

Snippet of Medusa’ ransomware function (Photo: Cyble)

It deletes all the files in the system drive and leaves a ransom. Following the encryption of files, the Medusa botnet is programmed to sleep for 24 hrs. CRIL researchers found the ransom note to be faulty in its implementation.

Brute force attacks launched by the Medusa botnet

The Medusa botnet launches brute force attacks on internet-connected devices using the ScanWorld function. Thereafter, it injects several other malicious payloads.

It defines containing common usernames and passwords through username_scanner and password_scanner. Upon successfully gaining access to a Telnet device, it sends a malicious payload using infection_medusa_stealer.

Backdoor access and SSH login attempts are made using FivemBackdoor and sshlogin code. A lack of related codes in the Python file let the researchers know that the Medusa botnet is not fully established or implemented.

The botnet collects the system information upon successful attack using the send_data() function, which is then sent to the cyberattacker’s remote server at hxxps://medusa-stealer[.]cc/add/bot. Details such as the username, IP address, operating system, hostname, CPU, and RAM usage are sent using the send function.

Details about the Mirai botnet

Mirai has been active since 2016 and targets Linux-based devices through routers, IP cameras, and IoT devices. It exploits vulnerabilities in these devices to gain initial access and can download other malware as programmed by the cybercriminal to exfiltrate data from various locations.

Mirai to Medusa Botnet

Cyberattacks observed by CRIL in January 2023 using the Mirai botnet (Photo: Cyble)

Since the Mirai Linux botnet is worked upon to target Linux machines, researchers are urging users to be cautious of downloading or accessing emails and links from unknown IP addresses and URLs.

Share this:

  • Click to share on LinkedIn (Opens in new window)
  • Click to share on Reddit (Opens in new window)
  • Click to share on Twitter (Opens in new window)
  • Click to share on Facebook (Opens in new window)
  • More
  • Click to email a link to a friend (Opens in new window)
  • Click to share on WhatsApp (Opens in new window)

Related

Tags: Cyble Mirai botnet reportMedusa botnetMirai linux botnetThe Cyber ExpressThe Cyber Express News
Previous Post

Sharp Healthcare Data Breach Puts 62,777 Patients Information At Risk

Next Post

Dell Releases New Updates For Tackling CVE-2023-23698 Vulnerability

Vishwa Pandagle

Vishwa Pandagle

Vishwa Pandagle is a Technical Writer at The Cyber Express. She writes cybersecurity news related to data breaches, ransomware, phishing, and best practices among others. She also writes about cybersecurity developments and likes interacting with experts in this field. When not working, she likes self-reflecting, meditating, volunteering, and going for long walks.

Related Posts

Microsoft Outlook Vulnerability
Firewall Daily

Microsoft Outlook Zero Day Vulnerability Actively Exploited

by Ashish Khaitan
March 19, 2023
GISEC Global 2023
Firewall Daily

GISEC Global 2023: H.E. Dr Mohamed Hamad Al-Kuwaiti Recognized for Outstanding Contributions in Advancing Global Cybersecurity

by Editorial
March 19, 2023
Gamekaking Data Breach
Dark Web News

Gamekaking Data Breach? Leakbase Claims to Upload 19 Million Rows of Stolen Information

by Ashish Khaitan
March 18, 2023
Medusa Ransomware Group
Data Breach News

Medusa Ransomware Group Targets National Institute of Ocean Technology

by Ashish Khaitan
March 18, 2023
BreachForums
Compliance

FBI Arrests BreachForums Operator ‘Pompompurin’, Slaps Cybercrime Charges

by Chandu Gopalakrishnan
March 18, 2023
Next Post
Dell Vulnerability

Dell Releases New Updates For Tackling CVE-2023-23698 Vulnerability

Latest Issue is Out. Subscribe Now

Women in Cybersecurity

Download Now

CRIL


Follow Us On Google News

Never miss an update. Subscribe!

* indicates required

Top 10 Cybersecurity Jobs

Categories

About The Cyber Express

The Cyber Express

Cyber Security News and Magazine

The Cyber Express is a handbook for all stakeholders of the internet that provides information security professionals with the latest news, updates and knowledge they need to combat cyber threats.

Follow The Cyber Express

Contact

For editorial queries: [email protected]

For marketing, PR & media partnerships: [email protected]

For media kit and digitals sales: [email protected]

For Sponsorship/Event Partnership: [email protected]

For Conferences related information: [email protected]

Our Address

We’re remote friendly, with office locations around the world:

San Francisco, Atlanta, Rome,
Dubai, Mumbai, Bangalore, Hyderabad,  Singapore, Jakarta, Sydney, and Melbourne

 

Headquarters:

The Cyber Express LLC
555 North Point Center E
Alpharetta, GA 30022, USA.

Tel: (678) 578-8838

Events: +1 (678) 578-4140

 

India Office:

Cyber Express Media Network
HD-021, 4th Floor, C Wing, Building No.4. Nesco IT Park, WE Highway, Goregaon East, Mumbai, Maharashtra, India – 4000063

Tel: (678) 578-8838

Events: +1 (678) 578-4140

Subscribe to Our Feed

RSS Feeds

Follow Us On Google News

© 2022 The Cyber Express (Cyber Security News and Magazine) | By Cyble Inc.

No Result
View All Result
  • Firewall Daily
  • Business News
  • Cyber Essentials
  • Features
  • Cyber Security Magazine
  • Events
    • World CyberCon Middle East 2023
    •  Cyber Security Webinar

© 2022 The Cyber Express (Cyber Security News and Magazine) | By Cyble Inc.

Welcome Back!

Login to your account below

Forgotten Password?

Retrieve your password

Please enter your username or email address to reset your password.

Log In

Add New Playlist

This website uses cookies. By continuing to use this website you are giving consent to cookies being used. Visit our Privacy and Cookie Policy.